CVE-2026-84647

Stapler, the web framework bundled with every Jenkins controller, fails to restrict the object types that can be instantiated during form data binding to those compatible with the expected field type (CWE-502, deserialization of untrusted data). An attacker who holds Overall/Read permission on a controller can submit crafted form data over the network to trigger instantiation of configuration-related types that the affected field was never intended to accept, with no user interaction required. Because unintended configuration-related classes can be constructed from attacker-controlled input, the CVSS 3.1 scoring anticipates high impact to confidentiality, integrity, and availability (8.8 High), though no public proof-of-concept is known. Every Jenkins installation on the weekly release line up to and including 2.579 and on the LTS line up to and including 2.568.2 is affected, as is any standalone deployment of Stapler 2107.v8dfcb_e8ed317 or earlier (other than the 2088.2093.vd7c3e58008a_6 line). No exploitation has been reported: the flaw is not in CISA KEV, has no known public PoC, and carries a low 0.4% EPSS probability of exploitation within 30 days.

What to do: Upgrade to a Jenkins weekly release later than 2.579 or an LTS release later than 2.568.2 that includes the fixed Stapler 2088.2093.vd7c3e58008a_6 (or newer); standalone Stapler users should move to that version as well. Until patching is complete, restrict Overall/Read permission to trusted accounts — especially on internet-exposed controllers — to reduce the attack surface. No public exploits or workarounds are documented, so prioritize controllers where untrusted users can reach Jenkins form and configuration endpoints.